How much does penetration testing cost? Build the model, not the range

#The cost per covered asset-day

The quantity that makes quotes comparable is cost per asset per day of coverage. For a consultancy test:

where $D$ is tester-days, $R$ the day rate and $A$ assets meaningfully tested. The denominator uses 365 because the test's coverage is what you rely on for the year. For continuous testing, divide the annual price by $A\cdot 365$ directly.

#Worked example (assumptions stated)

Assume a mid-size SaaS estate of 400 assets, a blended consultancy day rate of $1,800 (an assumption, not a quote), and two tests a year of 15 tester-days each covering 120 assets, plus $6,000 of retests.

"Days with fresh coverage" counts days when the result reflects the current environment — the testing window for a point-in-time test, every day for continuous testing. The comparison is deliberately crude; it makes the unit visible.

#Context: what you're insuring against

IBM's 2025 Cost of a Data Breach report put the global average breach at $4.44 million, down from $4.88 million in 2024, while the U.S. average rose to a record $10.22 million [1]. Testing budgets are usually justified against those numbers; the exposure-window model is a better way to argue which testing cadence actually moves the probability.

#Questions that expose a quote

• How many tester-days, and how many assets get hands-on attention?
• Are retests included, and for how long?
• Is exploitation attempted, or is it a scan with a report?
• Do findings include proof and reproduction steps?
• What happens after a significant change mid-year?

#Sources

1. [1] CyberScoop, “IBM Cost of a Data Breach 2025”